What is the CVSS score of CVE-2026-11536?

CVE-2026-11536 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of IBM WebSphere are affected by CVE-2026-11536?

IBM WebSphere Application Server versions 9.0 and 8.5 contain a remote code execution vulnerability allowing authenticated users with low-level credentials to achieve full compromise of the…. A patch is available.

How to fix or mitigate CVE-2026-11536?

Within 24 hours, identify all systems running IBM WebSphere Application Server 9.0 or 8.5 and restrict network access to the SOAP/JMX management connector to only authorized administrators. Within 7 days, obtain and apply IBM's released patch to all affected WebSphere instances. Within 30 days, verify patch deployment across all systems and audit management connector access controls to ensure only authorized personnel retain connectivity.

IBM WebSphere CVE-2026-11536

EUVD-2026-51274 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-30 ibm

GHSA-6qjg-94q2-5wvp

RCE Deserialization IBM Websphere Application Server

8.5

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

8.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.5 HIGH

Network-reachable JMX/SOAP connector gives AV:N; authenticated management access needed so PR:L; gadget-chain/preconditions justify AC:H; JVM RCE with scope change yields S:C and full C/I/A.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:52 vuln.today

CVE Published

Jul 30, 2026 - 19:02 cve.org

HIGH 8.5

DescriptionCVE.org

IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector.

AnalysisAI

Remote code execution in IBM WebSphere Application Server 9.0 and 8.5 allows an authenticated attacker to run arbitrary code by delivering a malicious serialized Java object through the SOAP/JMX connector, which the server deserializes unsafely (CWE-502). An attacker with low-level credentials who can reach the management connector can achieve full compromise of the application server process. IBM has released a fix; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Technical ContextAI

WebSphere Application Server exposes a JMX (Java Management Extensions) management interface over a SOAP connector, used for administrative and monitoring operations. The root cause is CWE-502, deserialization of untrusted data: the SOAP/JMX connector reconstructs Java objects from attacker-influenced serialized streams without adequately validating or restricting the object types (a classic Java gadget-chain deserialization sink). When a crafted object graph is deserialized, side effects during reconstruction (readObject/readResolve gadget chains present on the server classpath) can be leveraged to execute arbitrary code in the JVM context of the server. The single CPE provided, cpe:2.3:a:ibm:websphere_application_server:*, confirms the affected component is the WebSphere Application Server product itself rather than a bundled third-party library.

RemediationAI

Apply the vendor-supplied fix referenced in IBM's advisory at https://www.ibm.com/support/pages/node/7277544 (Patch available per vendor advisory); review that bulletin for the exact APAR/interim fix or fix pack level for WebSphere Application Server 9.0 and 8.5, as the input does not include a specific fixed version number to cite. As compensating controls until patching, restrict network access to the SOAP/JMX administrative connector so it is reachable only from trusted management hosts (firewall the SOAP connector port, commonly 8879/8880, to an admin subnet), enforce strong authentication and least privilege on management accounts to raise the bar on the PR:L requirement, and where supported enable/verify the Java deserialization filtering controls IBM ships for WebSphere. The trade-off of locking down the connector is that remote/automated administration tooling and monitoring integrations that rely on SOAP/JMX may break and require reconfiguration to run from the permitted admin hosts.